Mashreqbank Reaches $100 Million Resolution with NY DFS for Historical Sanctions Violations; Fed and OFAC Also Take Action

On November 9, 2021, Mashreqbank, PSC (“Mashreqbank” or the “Bank”) reached a $100 million multi-agency resolution with the New York State Department of Financial Services (“DFS” or the “Department”), the Federal Reserve Board of Governors (“Fed”) and the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”), in connection with its violations of the now-repealed Sudan-related sanctions.[1] While the monetary penalty amounts to the highest imposed in a multi-agency enforcement action for sanctions violations since spring 2019, this is the first multi-agency sanctions resolution where the monetary penalty was entirely imposed by the DFS. This is also Acting Superintendent Adrienne Harris’s first enforcement action against a financial institution.

Mashreqbank is a United Arab Emirates-based global bank with more than 37 branches worldwide and total assets of over $44 billion.[2] Its New York Branch is DFS-licensed and has assets of approximately $1.5 billion.[3] According to the regulators, between 2005 and 2009, Mashreqbank’s London Branch (“Mashreq London”) processed over 1,700 U.S. dollar-denominated funds transfers, totaling over $4 billion, through its New York Branch and other U.S. financial institutions, for Sudanese entities in direct violation of U.S. sanctions regulations.[4] In processing those payments, Mashreq London avoided populating certain fields in the MT-202 bank-to-bank payment messages to conceal the Sudanese connections, which enabled the transactions to bypass the sanctions filters of the intermediary banks.[5] The DFS also found that, between 2010 and 2014, the New York Branch processed an additional $2.5 million of prohibited payments involving less obvious ties to Sudan (for example, a number of these customers were not resident or domiciled in Sudan, and the payment instructions did not reference Sudan), despite the Bank’s notice that its prior Sudanese-related transactions were problematic.[6] Neither OFAC nor the Fed reference the 2010–2014 activity, and DFS did not provide any additional detail as to these transactions.

This resolution shows that large, multi-agency enforcement actions against banks for “wire stripping” or other non-transparent payment methods—involving conduct largely from more than a decade ago—continue to be brought. Although comprehensive U.S. sanctions against Sudan were revoked in 2017, this resolution demonstrates the importance of global financial institutions implementing and maintaining risk-based internal controls, policies and procedures to ensure that transactions are processed in a transparent manner, including by disclosing to U.S. intermediary parties the involvement of any parties targeted by OFAC sanctions.

DFS Consent Order

The DFS’s Consent Order followed the Department’s 2018 consent order against Mashreqbank where it cited the Bank for failure to maintain effective BSA/AML and OFAC compliance programs, fined the Bank for $40 million, and required a six-month lookback on USD clearing activity and the hiring of an independent consultant to oversee remediation. After issuing the 2018 consent order, the DFS continued to investigate the Bank’s USD transactions relating to Sudan.[7] The DFS found that, “notwithstanding an evident awareness of the applicability of the long-standing Sudanese sanctions, between 2005 and 2009, the Bank by design, structured Sudan-related payments to avoid detection of the Sudanese element by U.S.-based banks.”[8] In particular, the DFS noted that Mashreqbank had maintained policies and procedures between 2005 and 2014 that prohibited the use of its U.S. correspondent accounts to process Sudan-related payments without an OFAC license or exemption, but nevertheless used cover payments to process USD transactions for Sudanese banks.[9]

The DFS’s investigation further revealed that Mashreqbank had a long history of inadequacies in its OFAC compliance policies and procedures, despite the Bank’s awareness of the inadequacies, which facilitated the prohibited transactions. Prior to 2001, the Bank’s procedures “were designed to avoid notifying other banks of the Sudanese connections to certain transactions,” including instructions that Bank employees omit information that could trigger freezes under U.S. sanctions laws.[10] In 2001, the Bank reviewed and modified its procedures in response to repeated requests for additional information and complaints about BSA compliance from its New York Branch.[11] However, the modified procedures instructed Bank employees to route all Sudan-related payments through a particular Swiss bank without populating the optional “originating institution field” in the payment messages and further instructed that “Sudanese Bank, Khartoum, or Sudan or any other short form to indicate these names” not be included in any payment message sent to the Swiss bank.[12] The DFS also noted that the Bank’s senior management—including the Head of Compliance, Head of Risk Management Division and Head of Audit—had been warned about and recognized the non-compliance of the Bank’s Sudan-related procedures, but nonetheless failed to make any changes for several years.[13]

During the 2005–2009 time period, the Bank adopted several changes to its sanctions compliance policies and procedures. In 2005, the Bank distributed internally a Compliance Circular cautioning that USD transactions involving sanctioned countries should generally be avoided and, if necessary, should not involve U.S. accounts, but Mashreq London failed to refer its Sudan-related transactions to the Bank’s Compliance department as required by the Circular.[14] In 2006, the Bank implemented a Work Instruction requiring Mashreq London and other foreign branches to route USD transactions through another Swiss bank and prohibiting the involvement of the Bank’s accounts at U.S. banks.[15] Despite these compliance enhancements, Mashreq London continued to process transactions on behalf of Sudanese banks until 2009. Mashreq London, despite having been informed of the Work Instruction and its meaning and significance, continued to process transactions for Sudanese banks using cover payments.[16] And notably, in 2007, the Bank’s Head Office decided to accept the practice of cover payments for Sudan-related transactions, despite the Bank’s policy of prohibiting all USD transactions related to another sanctioned country, Iran.[17]

The DFS also faulted Mashreqbank for its failure to report the Sudan-related transactions after receiving notice that those transactions were problematic. In 2009, the Swiss intermediary bank that processed Mashreqbank’s Sudan-related transactions rejected a transaction sent by the Bank, and news soon broke that the Swiss bank was investigated by the New York County District Attorney’s Office for sanctions violations.[18] Although Mashreqbank decided to close all its USD accounts held by Sudanese banks, it did not report its prior transactions to the DFS until it received an OFAC subpoena in 2015.[19]

The Consent Order cited Mashreqbank for multiple violations of laws and regulations, including: (i) conducting business in an unsafe and unsound manner in violation of N.Y. Banking Law § 44; (ii) failing to maintain and make available true and accurate books, accounts and records reflecting the true nature of all transactions and actions in violation of N.Y. Banking Law § 200-c; (iii) failing to maintain an effective OFAC compliance program in violation of 3 N.Y.C.R.R. § 116.2; (iv) omitting true entries of certain material information pertaining to the business of the Bank so as to deceive or mislead Bank directors, trustees and officers, as well as the Superintendent and other employees of the Department, in violation of 3 N.Y.C.R.R. § 3.1; (v) failing to report to the Superintendent of the Department immediately upon the discovery of the making of false entries and omission of true entries, in violation of 3 N.Y.C.R.R. § 300.1(a); and (vi) failing to report to the Superintendent of the Department one or more incidents that appeared to “relate[] to a plan or scheme” that “would be of interest to similar organizations located in the same area or throughout the state,” in violation of 3 N.Y.C.R.R. § 300.4.[20] Other than the $100 million penalty, the DFS did not require a transaction review or independent consultant. The DFS also acknowledged that the Bank’s OFAC compliance program has now been determined adequate.[21]

The Fed Cease and Desist Order

The Fed issued a consent cease and desist order against Mashreqbank for its sanctions-violating transactions and for “lack[ing] adequate risk management supervision and oversight of its branches to ensure compliance with applicable OFAC Regulations.”[22] While the cease and desist order does not impose a monetary penalty on the Bank, it requires the Bank to: (i) submit to the Fed an acceptable OFAC Compliance Program applicable to the bank’s global business lines; (ii) engage an independent external party to conduct annual OFAC Compliance Reviews; and (iii) complete a global OFAC risk assessment with particular attention to transactions involving group affiliates, branches and subsidiaries.[23] The cease and desist order also provides that the Bank will not in the future retain any individual who participated in the misconduct underlying the order or have been subject to a disciplinary action by the Bank related to the misconduct.[24]

OFAC Finding of Violation

OFAC issued a no-fine Finding of Violation (“FOV”) against Mashreqbank, as opposed to a civil monetary penalty, in part because Mashreqbank voluntarily entered into a retroactive waiver of OFAC’s five-year statute of limitations, without which, as OFAC expressly acknowledged, OFAC would have been time-barred from charging the violations.[25] In deciding to issue the FOV, OFAC considered as aggravating factors the high volume and time span of the Bank’s prohibited transactions, the Bank’s recklessness in employing practices that did not identify sanctioned parties in specific payments, senior employees’ actual knowledge of the illegal conduct and the Bank’s deficient internal controls.[26] Meanwhile, OFAC also credited the Bank’s “substantial cooperation” throughout the investigation, including waiving the statute of limitations, as well as its “extensive remediation of its sanctions compliance program” since 2007, including significantly increased compliance staffing and spending, closing of all Sudanese accounts, risk-based compliance reform, mandatory inclusion of originating bank and customer information in payment messages, automated screening, restricting USD payments only through the U.S., engaging external consultant to conduct OFAC risk assessment and gap analysis, and upgrading vendor sanctions screening software.[27] OFAC also acknowledged that Mashreqbank has not received a penalty or FOV from OFAC in the five years preceding the earlier date of the prohibited transactions, and that the total harm caused was less than the total value of the transactions, because some of the transactions represented the same pool of funds moving through the U.S. financial system multiple times.[28]

We will continue to monitor AML and sanctions developments and look forward to providing you with further updates.

                                                                                                                                  *       *       *

[1]        New York Dep’t Fin. Services, Press Release, Acting Superintendent Adrienne A. Harris announces $100 Million Penalty on Mashreqbank for Violations of Sanctions Laws (Nov. 9, 2021), available here; Bd. of Governors of the Fed. Reserve Sys., Press Release, Federal Reserve issues consent order against Mashreqbank for firm’s unsafe and unsound practices related to sanctions compliance, (Nov. 9, 2021), available here; OFAC, Enforcement Release, OFAC Issues a Finding of Violation to Mashreqbank psc for Violations of the Sudanese Sanctions Regulations (“OFAC FOV”) (Nov. 9, 2021), available here.

[2]        New York Dep’t Fin. Services, Consent Order (“DFS Consent Order”) at 1 (Oct. 26, 2021), available here.

[3]        Id.

[4]        Id. ¶ 4; Bd. of Governors of the Fed. Reserve Sys., Order to Cease and Desist Issued Upon Consent Pursuant to the Federal Deposit Insurance Act, as Amended (“Fed Cease and Desist Order”), at 2 (Oct. 26, 2021), available here; OFAC FOV at 1.

[5]        DFS Consent Order ¶¶ 9–11.

[6]        Id. ¶¶ 4, 8, 38.

[7]        Id. at 2.

[8]        Id. ¶ 4.

[9]        Id. ¶ 12.

[10]       Id. ¶ 19.

[11]       Id. ¶ 20.

[12]       Id. ¶ 22.

[13]       Id. ¶ 27.

[14]       Id. ¶¶ 28–31.

[15]       Id. ¶ 33.

[16]       Id. ¶ 34.

[17]       Id. ¶ 35.

[18]       Id. ¶¶ 36–37.

[19]       Id. ¶¶ 37–38.

[20]       Id. ¶¶ 43–48.

[21]       Id. ¶ 52.

[22]       Fed Cease and Desist Order at 2

[23]       Id. at 3–5.

[24]       Id. at 5.

[25]       OFAC FOV at 1

[26]       Id. at 1–2.

[27]       Id. at 2–3.

[28]       Id.